CVE-2025-37905

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> firmware: arm_scmi: Balance device refcount when destroying devices<br /> <br /> Using device_find_child() to lookup the proper SCMI device to destroy<br /> causes an unbalance in device refcount, since device_find_child() calls an<br /> implicit get_device(): this, in turns, inhibits the call of the provided<br /> release methods upon devices destruction.<br /> <br /> As a consequence, one of the structures that is not freed properly upon<br /> destruction is the internal struct device_private dev-&gt;p populated by the<br /> drivers subsystem core.<br /> <br /> KMemleak detects this situation since loading/unloding some SCMI driver<br /> causes related devices to be created/destroyed without calling any<br /> device_release method.<br /> <br /> unreferenced object 0xffff00000f583800 (size 512):<br /> comm "insmod", pid 227, jiffies 4294912190<br /> hex dump (first 32 bytes):<br /> 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........<br /> ff ff ff ff ff ff ff ff 60 36 1d 8a 00 80 ff ff ........`6......<br /> backtrace (crc 114e2eed):<br /> kmemleak_alloc+0xbc/0xd8<br /> __kmalloc_cache_noprof+0x2dc/0x398<br /> device_add+0x954/0x12d0<br /> device_register+0x28/0x40<br /> __scmi_device_create.part.0+0x1bc/0x380<br /> scmi_device_create+0x2d0/0x390<br /> scmi_create_protocol_devices+0x74/0xf8<br /> scmi_device_request_notifier+0x1f8/0x2a8<br /> notifier_call_chain+0x110/0x3b0<br /> blocking_notifier_call_chain+0x70/0xb0<br /> scmi_driver_register+0x350/0x7f0<br /> 0xffff80000a3b3038<br /> do_one_initcall+0x12c/0x730<br /> do_init_module+0x1dc/0x640<br /> load_module+0x4b20/0x5b70<br /> init_module_from_file+0xec/0x158<br /> <br /> $ ./scripts/faddr2line ./vmlinux device_add+0x954/0x12d0<br /> device_add+0x954/0x12d0:<br /> kmalloc_noprof at include/linux/slab.h:901<br /> (inlined by) kzalloc_noprof at include/linux/slab.h:1037<br /> (inlined by) device_private_init at drivers/base/core.c:3510<br /> (inlined by) device_add at drivers/base/core.c:3561<br /> <br /> Balance device refcount by issuing a put_device() on devices found via<br /> device_find_child().